From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50416) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VOog0-000397-OQ for qemu-devel@nongnu.org; Wed, 25 Sep 2013 08:58:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VOofv-0000Ap-6I for qemu-devel@nongnu.org; Wed, 25 Sep 2013 08:58:44 -0400 Sender: fluxion From: Michael Roth Date: Wed, 25 Sep 2013 07:57:38 -0500 Message-Id: <1380113886-16845-11-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1380113886-16845-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1380113886-16845-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 10/38] virtio: virtqueue_get_avail_bytes: fix desc_pa when loop over the indirect descriptor table List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: yinyin virtqueue_get_avail_bytes: when found a indirect desc, we need loop over it. /* loop over the indirect descriptor table */ indirect = 1; max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc); num_bufs = i = 0; desc_pa = vring_desc_addr(desc_pa, i); But, It init i to 0, then use i to update desc_pa. so we will always get: desc_pa = vring_desc_addr(desc_pa, 0); the last two line should swap. Cc: qemu-stable@nongnu.org Signed-off-by: Yin Yin Reviewed-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin (cherry picked from commit 1ae2757c6c4525c9b42f408c86818f843bad7418) Signed-off-by: Michael Roth --- hw/virtio/virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index f03c45d..2f1e73b 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -377,8 +377,8 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes, /* loop over the indirect descriptor table */ indirect = 1; max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc); - num_bufs = i = 0; desc_pa = vring_desc_addr(desc_pa, i); + num_bufs = i = 0; } do { -- 1.7.9.5